did you try restarting Splunkd service it will clear anything that has not updated in UI. Else you can try https://<splunk server>:8000/debug/refresh.   may be user has been removed and is just visible on UI.   hope that helps.   ... View more

So far what i can see is either there is a DB and we use DB connect app or the REST endpoint from which data can be collected.  There is not much info about his netsuite on internet so only guessing best possible solutions. ... View more

I have moved the post to new post.  @manojchacko78  please ask new questions in separate posts.    regards, Singhk ... View more

Is there a DB with netsuite?  ... View more

Hmm interesting.. will check and find something. ... View more

And do you see the forwarder under  forwarder management ? ... View more

I meant were you able to get through to DS from the Splunk forwarder box using telnet. ror was it showing unable to connect or the error? ... View more

can you telnet on port 8089 to DS? ... View more

Need more info on that.. inputs.conf from indexer what port is configured etc. outputs.conf from forwarder ... View more

Are you using correct index as it points to a index on your splunk instance where all windows data is and it could be of a different name.  to check the correct index name run Ty e first search and check index field and name of index . ... View more

Heavy forwarders do not need license they come in with a forwarders license which you can enable.  now on a hf  you can install addons specific to data you want to gather and create inputs to gather data.  there has to be a outputs config for forwarder to forward data to indexers in splunk cloud. universal forwarder is entirely diff forwarder and easiest to configure. Install that on a windows or Linux box you want to monitor for logs or metrics data and add and configure respective Addons and point it to a forwarding location. and you should be all set. ... View more

Just with a small correction  index=* |stats count first(_raw) ….. rest is same. I think autocorrect messed it up. ... View more

Check the link I have posted below. ... View more

for more info refer t o the link below https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Monitorfilesanddirectorieswithinputs.conf  ... View more

File input does the same thing , it monitors file. ... View more

try this index=fw | search appcat=Remote.Access | search app!="RDP" AND app!="WMI.DCERPC" | lookup network_assets.csv cidr OUTPUT src | search usertags="*server*" | table src dest app url appcat usertags ... View more

try and read documentation for windows addon. Should be on the same link ... View more

install this addon in UF and create your inputs by copying inputs.conf to local directory and changing    https://splunkbase.splunk.com/app/742/ disabled = 0  you will have some predefined inputs  which you can use from inputs.conf just enable them. ... View more

And on indexers do you see index as enabled or disabled ?  or do you see any errors in splunkd logs related to index? ... View more

Ideally index should be in the app you created for indexes.conf ... View more

Run btools to check indexes.conf on indexer. Share results or check if index shows up in the list ... View more

Those all will have separate entitlements added to your account only then you can see those apps or info related to them. ... View more